← Articles and guides on fraud, cybersecurity, privacy and AML

Cybercrime penalties compared: Brazil, the US and Latin America

From ANPD fines to billion-dollar DOJ pleas: verified penalties for digital crime, data breaches and money laundering in Brazil, the US and Latin America.

2026-10-26

Comparing cybercrime penalties across countries is harder than it looks: penal codes use different categories, sentences change, and many tables circulating online were never checked against official texts. This comparison therefore lists only verified penalties: sanctions actually imposed, or penalties confirmed in primary or specialist sources. Statutory prison terms for computer intrusion and electronic fraud will follow in a later edition, after article-by-article checks.

Two kinds of punishment

The criminal track punishes individuals, and sometimes companies through plea agreements. The administrative track fines companies for security, privacy or anti-money-laundering failures. The largest sums tend to show up where the two overlap, in money laundering.

Brazil

LGPD: by early 2026 the ANPD had issued one monetary fine, R$14,400 against Telekall (2023); other sanctions were warnings and corrective orders (Confidata). It opened 19 new proceedings in June 2026.
ECA Digital (children online): fines of up to 10% of group revenue in Brazil, with sanctions expected from November 2026 (Mayer Brown).
COAF: R$96.9 million in AML fines in 2025, led by jewelry, luxury goods and factoring (COAF).

United States

Binance (2023): $4.32 billion in the DOJ agreement alone, plus FinCEN, OFAC and CFTC settlements (IRS-CI).
TD Bank (2024): guilty plea and $3.09 billion in penalties with a US asset cap (American Banker).
OKX (2025): guilty plea and over $504 million (AML Watcher).
FTC: $20 million against Cognosphere and $10 million against Disney under COPPA (Perkins Coie).
NYDFS: $2 million against PayPal for cybersecurity failures (Frankfurt Kurnit).

Latin America

Country	Verified penalty	Track
Mexico	Money laundering (Art. 400 Bis): 5–15 years and 1,000–5,000 day-fines; doubled for officials in the field	Criminal
Colombia	Money laundering (Art. 323): 10–30 years and fines of 1,000–50,000 minimum wages	Criminal
Colombia	Movistar: COP 670 million for unauthorized marketing (SIC, 2025)	Administrative
Chile	Law 21,663: up to 20,000 UTM for essential services, 40,000 UTM for vital operators	Administrative

Sources: Mexico's Art. 400 Bis, Colombia's Art. 323 and Cuatrecasas on Chile. In June 2025, FinCEN also cut off fund transfers with three Mexican institutions under the FEND Off Fentanyl Act (Morrison Foerster).

Takeaways

The biggest sums come from US criminal settlements over money laundering, not privacy fines.
In Brazil, breach fines remain rare, but proceedings are rising and ECA Digital adds a 10% cap.
Latin American laundering sentences are long, up to 30 years in Colombia, and new cyber agencies such as Chile's ANCI can fine.